Extract public Certificate from SMIME Message (pkcs7-signature) with OpenSSL

encryption cryptography openssl smime
x2on picture x2on · Apr 15, 2011 · Viewed 25.5k times · Source

How can i extract the public certificate from an smime message (pkcs7-signature) with OpenSSL?

Answer

Thomas Pornin picture Thomas Pornin · Apr 18, 2011

With the command-line tool, assuming the S/MIME message itself is in file message:

openssl smime -verify -in message -noverify -signer cert.pem -out textdata

This writes the signer certificate (as embedded in the signature blob) into cert.pem, and the message text data in the textdata file.

Alternatively, you can save the signature blob as an independent file (it is just a kind of attachment, so any mailer application or library should be able to do that. Then, assuming that the said blob is in a file named smime.p7s, use:

openssl pkcs7 -in smime.p7s -inform DER -print_certs

which will print out all certificates which are embedded in the PKCS#7 signature. Note that there can be several: the signer's certificate itself, and any extra certificates that the signer found fit to include (e.g. intermediate CA certificates which may help in validating his certificate).

Related questions

Encryption/decryption doesn't work well between two different openssl versions

I've downloaded and compiled openssl-1.1.0. I can encrypt and decrypt using the same exe of openssl (as is here) me@ubuntu:~/openssl-1.1.0$ LD_LIBRARY_PATH=. ./apps/openssl aes-256-cbc -a -salt -in file.txt -out file.txt.enc enter aes-256…

Read More
EVP_DecryptFinal_ex:bad decrypt when using Node.js

Using the following node js: var crypto = require('crypto'); var encrypt = function (input, password, callback) { var m = crypto.createHash('md5'); m.update(password); var key = m.digest('hex'); m = crypto.createHash('md5'); m.update(password + key); var iv = …

Read More
Select different padding modes in OpenSSL commands

I wrote a Java Card applet to do DES encryption/Decryption. The source code of my applet (If you want to use it, consider that Mr Bodewes found some bugs in this source code (those are mentioned in the comments …

Read More